{
  "@id": "urn:uuid:9832540d-02fc-4557-9694-97e6f1d044fd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T00:56:31.713844+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:31.713844+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 is fixed in version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Target is not affected by CVE-2021-28164. The upstream security fix (commit e412c8a15b3334b30193f40412c0fbc47e478e83, GHSA-v7ff-8wcx-gmc5) was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded (first TuxCare commit 961b5988ccd \"setup 10.0.26\"). The vulnerable pattern\u2014unnormalized percent-encoded dot segments allowing WEB-INF access\u2014is not present because HttpURI.getDe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 Target is not affected by CVE-2021-28164. The upstream security fix (commit e412c8a15b3334b30193f40412c0fbc47e478e83, GHSA-v7ff-8wcx-gmc5) was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded (first TuxCare commit 961b5988ccd \"setup 10.0.26\"). The vulnerable pattern\u2014unnormalized percent-encoded dot segments allowing WEB-INF access\u2014is not present because HttpURI.getDe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 (encoded URI path traversal to access WEB-INF resources) is NOT present in Jetty 10.0.26. The vulnerability was fixed in upstream Jetty 10.0.6, and all defenses are present in this version: (1) HttpURI decodes paths before normalizing to prevent double-decode attacks, (2) encoded null bytes are rejected, (3) PathResource.addPath() validates canonical paths, (4) ServletContext met...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 (encoded URI path traversal to access WEB-INF resources) is NOT present in Jetty 10.0.26. The vulnerability was fixed in upstream Jetty 10.0.6, and all defenses are present in this version: (1) HttpURI decodes paths before normalizing to prevent double-decode attacks, (2) encoded null bytes are rejected, (3) PathResource.addPath() validates canonical paths, (4) ServletContext met..."
    }
  ]
}